By Andrew Glenn
Intelligence and law enforcement agencies are always looking for the next piece of technology to help them maintain an edge on their adversaries. With cell phones being used by the vast majority of people in the United States, law enforcement has turned to new technology to collect cell phone traffic. This is where the controversial piece of technology, called the international mobile subscriber identity-catcher (IMSI catcher), comes into play. The most commonly used version is created by Harris Corporation and known as StingRay, the name generally used for all IMSI catchers. First developed in 2003, the IMSI catcher essentially acts as a cell phone tower for a given area and intercepts all cell phone traffic in that given area. It does this by acting as a cell tower and emitting a signal stronger than the actual tower so the cell phone connects with the IMSI catcher rather than the cell tower. The StingRays may be handheld or attached to a vehicle such as a patrol car or aircraft allowing for greater mobility.
Due to the function of an IMSI, there are inherent 4th Amendment issues that arise from its use. First, there has been suboptimal use of warrants in order to use an IMSI. Law enforcement agencies have all signed non-disclosure agreements (NDA) with either the FBI or Harris Corporation in which they argue prevents them from disclosing any information about the IMSI’s they use and when they use them. Law enforcement has used the NDAs as an excuse to avoid providing certain information to judges and defendants. Sometimes this results in prosecutors dropping the case to comply with the NDAs. But other times it results in clear constitutional violations. There have been a multitude of cases where law enforcement has refused to get a warrant to use their IMSI catchers because they argue that they themselves are forbidden to disclose this information due to the NDAs they signed. In Tallahassee, Florida, law enforcement refused to provide information to a defendant on how they obtained information about the defendant. In Tacoma, Washington the Police Department was required to provide information about the IMSI they used. Yet, when the information was disclosed, it was so heavily redacted that it was virtually unreadable. In 2005, the FBI released a statement to clarify about the NDA and Stingray policy stating that the “NDA should not be construed to prevent a law enforcement officer from disclosing to the court or a prosecutor the fact that this technology was used in a particular case.” Recently there has been a shift from this position as courts in Florida and Maryland have all ruled that a warrant is always required to use an IMSI catcher on a target device. (Id.)
However, a recent landmark case, Carpenter v. United States, created a mandatory use for a warrant when using an IMSI. In Carpenter, the police were investigating a number of connected armed robberies. One man in connection with the crimes was arrested and gave up the numbers of others involved. The police then compelled cell site location information from a provider without a warrant. The Supreme Court held that the warrantless acquisition of Carpenter’s phone location data was deemed a search and thus required a warrant. In the majority opinion the court illustrated that since a phone is carried with a person wherever they go there is an “inescapable and automatic nature of collection” of cell site data location (CSLI). Therefore, there is a legitimate expectation of privacy in Carpenter’s location data. This case now essentially requires law enforcement officials to use a warrant anytime they use an IMSI catcher because an IMSI collects CSLI and more. Yet, there is still the exigent circumstances or emergency doctrine exception which has been claimed by law enforcement to sidestep the warrant process. Carpenter v. United States, 138 S. Ct. 2206 (2018).
Even if a warrant is granted to use an IMSI to collect or intercept data from a suspect’s phone, it still violates other people’s Fourth Amendment rights who just happen to be in the same area as the suspect. This is because the Stingray cannot selectively collect data of one person’s phone; it instead collects the data from every phone in the area (sometimes over 10,000 phones) that connect with the IMSI. The IMSI user then selects the target’s phone and acquires that data. This essentially means that every person’s phone in the vicinity is searched despite no warrant being sought. . Even if the data is not viewed or saved, it still violates their constitutional protections. Additionally, there is no oversight for what happens with other people’s information which is acquired during the lawful search of a suspect’s phone by an IMSI catcher. At this time there are no known universal minimization procedures for data collected at the state and local level.
Despite the continued use of IMSI catchers it can only be hoped that new legislation may be enacted to help regulate IMSI’s and safeguard citizens 4th Amendment rights.